the questionnaire asks how we secure working from home and remote access

Remote access falls under access control and MFA

The question about remote work and remote access is usually a combination of two of the ten measures from Article 21(2) NIS2: point (i), access control and management of business assets, and point (j), the use of multi-factor authentication. Customers who ask about this separately want to know how an employee gains access to business systems from a private network or their own laptop, and what barriers are in place. A VPN connection alone is not an answer to this question — it is about the combination of encrypted connection, authentication and device management.

Concrete evidence usually consists of three parts: a VPN or zero-trust configuration with encryption, an MFA requirement that also applies to remote access (not only to the corporate network), and an overview of which devices are allowed access — private or business. If a Mobile Device Management solution is running, that is strong evidence. If that is missing, the answer is often "no" for the device management component, even if MFA is in place. In that case, fill in separately for each component what is and is not arranged, instead of one summarised "yes" or "no" — this prevents an incorrectly marked "no" on a question that is actually half correct. If encryption of the traffic itself is the subject of the question, then that belongs more to the policy on cryptography and encryption than to access. If you are unsure which box this exactly touches, also check whether the question is actually about the access policy including management of business assets — often they are two separate sub-questions packed into one line.

Where this is located: Article 21(2), points i and j

Article 21(2) of Directive (EU) 2022/2555 lists access control and management of business assets as point (i) and the use of multi-factor authentication or continuous authentication as point (j), alongside encryption as point (h). ISO/IEC 27001 Annex A elaborates further on control measures for access security and equipment outside the business premises. The Cybersecurity Act will adopt this structure once it enters into force on 15 August 2026, so the structure of the question will not change then — only who is required to answer it.